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Introduction 


The Information Commissioner is producing a direct marketing code 
of practice, as required by the Data Protection Act 2018. A draft of 
the code is now out for public consultation. 


The draft code of practice aims to provide practical guidance and 
promote good practice in regard to processing for direct marketing 
purposes in compliance with data protection and e-privacy rules. 
The draft code takes a life-cycle approach to direct marketing. It 
starts with a section looking at the definition of direct marketing to 
help you decide if the code applies to you, before moving on to 
cover areas such as planning your marketing, collecting data, 
delivering your marketing messages and individuals rights. 


The public consultation on the draft code will remain open until 4 
March 2020.The Information Commissioner welcomes feedback on 
the specific questions set out below. 


You can email your response to directmarketingcode@ico.org.uk 
Or print and post to: 


Direct Marketing Code Consultation Team 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the consultation, please 
email the Direct Marketing Code team. 


Privacy statement 


For this consultation we will publish all responses received from 
organisations except for those where the response indicates that they 
are an individual acting in a private capacity (eg a member of the 
public). All responses from organisations and individuals acting in a 
professional capacity (eg sole traders, academics etc) will be published 
but any personal data will be removed before publication (including 
email addresses and telephone numbers). 


For more information about what we do with personal data please see 
our privacy notice 


Q1 Is the draft code clear and easy to understand? 


x] 


Yes 
No 


If no please explain why and how we could improve this: 


Q2 Does the draft code contain the right level of detail? (When 
answering please remember that the code does not seek to 
duplicate all our existing data protection and e-privacy guidance) 


x] 


Yes 
No 


If no please explain what changes or improvements you would like to 


see? 


Q3 Does the draft code cover the right issues about direct marketing? 


xX Yes 


No 


If no please outline what additional areas you would like to see 
covered: 


Generally yes, but it would be useful to have guidance on direct marketing in the business 
to business, rather than business to consumer context. 


Q4 Does the draft code address the areas of data protection and e- 
privacy that are having an impact on your organisation’s direct 
marketing practices? 


Yes 
x! No 


If no please outline what additional areas you would like to see covered 


e The Code is very business-to-consumer (B2C) focused. It would be useful to see 
more business-to-business (B2B) examples in the Code. 
At page 81 the Code provides an example which begins to helpfully explain a 
common networking event scenario and the collection of business cards. However, 
the example does not demonstrate how best to meet transparency obligations in 
this scenario. This is a common difficulty for organisations in this position, and 


unfortunately this example is missing guidance at this crucial point. Therefore, it 
would be beneficial if the Code provided guidance on how it envisages the 
collection of business cards at a networking event (to be used for e-marketing 
purposes) can occur in a GDPR compliant way with an emphasis on how to 
practically meet the GDPR transparency obligation. 


Q5 Is it easy to find information in the draft code? 


x] 


Yes 
No 


If no, please provide your suggestions on how the structure could be 
improved: 


Q6 Do you have any examples of direct marketing in practice, good or bad, 
that you think it would be useful to include in the code 


x] 


Yes 
No 


If yes, please provide your direct marketing examples : 


Q7 


Do you have any other suggestions for the direct marketing code? 


Tracking pixels are mentioned at page 87 of the Code. It would be helpful if the 
ICO could provide examples of how it would it envisages the lawful collection of 
consent for the use of tracking pixels for direct e-marketing purposes. 

If consent is required for e-marketing, profiling, pixels and cookies, does this mean 
that the collection of consent should be separated for each? If so, could the ICO 
provide an example of good industry practice of what this should look like - 
including in the B2B context. The principle of consent is very clearly explained, but 


crucially it would be useful if the Code gave practical examples of how the ICO 
would expect organisations to collect consent for all of these marketing activities. 
Page 4 of the Code discusses carrying out ‘appropriate due diligence’ when using 
enrichment services. Could the ICO provide examples of what appropriate due 
diligence could look like or include. It is clear that this could vary on a case by case 
basis, but an illustrative list of examples would be very useful. 


About you 


Q8 Are you answering as: 


O An individual acting in a private capacity (eg someone 
providing their views as a member of the public) 

O An individual acting in a professional capacity 

Kl On behalf of an organisation 

O Other 


Please specify the name of your organisation: 


Ernst & Young LLP 


If other please specify: 


PT 


How did you find out about this survey? 


Q 
Ne) 


ICO Twitter account 

ICO Facebook account 

ICO LinkedIn account 

ICO website 

ICO newsletter 

ICO staff member 

Colleague 

Personal/work Twitter account 
Personal/work Facebook account 
Personal/work LinkedIn account 
Other 

If other please specify: 


Pd 


Thank you for taking the time to complete the survey 
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